Introduced in #2111, this gets caught by GCC's -Wformat-security which
is enabled as an error in our nightly builds.